Cloudflare Reproduces Remote Spectre Attack on Workers, Reads Data at 12 Bits per Second
The successful reproduction shows that Cloudflare's existing countermeasures, including DyPrIs and disabled multithreading, were insufficient against a remote timer that amplifies cache timing differences over the network.
Reporting from 1 source: GIGAZINE.
Cloudflare reproduced a remote Spectre attack in its production Workers environment, reading JWT tokens from another Worker with over 99% accuracy at up to 12 bits per second. The attack used a network-based timer and PLRU cache amplification to overcome the lack of an internal high-precision clock. The techniques have already been mitigated.
Cloudflare's security team ran the attack between two Workers it controls in production, targeting JWT tokens stored in the victim Worker's memory. The readout reached 12 bits per second with over 99% accuracy, a major jump from the 120 bits per hour ceiling of earlier remote timer research from 2021.
The key advance was using the Pseudo Least Recently Used mechanism to amplify the few-nanosecond difference between cache hits and misses into a signal large enough to survive network latency. The team then used a remote timer over WebSocket as the clock, since Workers deliberately freeze time during CPU processing.
Cloudflare states the attack techniques used in the research have already been mitigated in production.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.